Benevest — Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account information: name, email address, password (hashed), phone number, role (NGO or Sponsor), account plan (FREE, PREMIUM), createdAt, updatedAt, lastLoginAt.
• Organization (NGO) data: organization name, organization email, organization phone, organization description, address (street, city, state, country, zipCode), EIN / organization ID, registration letter (letter-id) and related documents provided for verification.
• Purchases and transaction history: donation records, subscription status, receipts. Payment card details are not collected or stored by us (see Payments section).
• Derivative / usage data: device information, log data, crash reports, usage analytics collected automatically via analytics/crash reporting services (e.g., Firebase Analytics, Firebase Crashlytics, Google Analytics).
• Content you upload: campaign text, images, banners and other user-generated content from NGOs.

2. Sensitive Information

We collect identity-related documents (e.g. NGO registration letters, eID) only from NGOs for verification purposes. We do not collect health, biometric, or government personal identifiers like Social Security numbers from sponsors. If NGO verification requires additional sensitive documents in the future, we will update this policy and notify affected users.

3. How We Collect Information

• Directly from you when you register, create or edit a campaign, or donate/subscribe.
• Automatically through analytics and crash-reporting SDKs (Firebase services).
• From third-party payment processors when you complete payments (we only receive transactional metadata, not raw card numbers).

4. How We Use Information

We use personal information to:

• Provide, operate, and maintain the App and associated services (account management, campaigns, donations, subscriptions).
• Verify NGO identities and eligibility to create campaigns.
• Process transactions and manage subscriptions via third-party providers.
• Monitor and improve App performance, diagnose technical issues, and analyze usage patterns.
• Comply with legal obligations and protect the safety and security of the platform.
• Respond to user inquiries and provide support.

5. Disclosure & Third Parties

We do not sell users’ personal information. We disclose information to third-party service providers who perform services on our behalf under contract and only as necessary:

• Firebase (Google LLC) — authentication, database, analytics, crash reporting.
• RevenueCat — subscription management (in-app subscriptions).
• Google Play Billing — in-app purchases/subscriptions.
• PayPal — donation processing.

These providers maintain their own privacy policies and, where applicable, provide Data Processing Agreements (DPAs) in line with GDPR requirements.

6. Payments & Financial Data

All payment processing is handled by third parties (PayPal, Google Play Billing, RevenueCat). We do not store or process raw card numbers or full bank account details. Transaction metadata (amount, date, merchant, receipt) is stored to maintain donation and subscription history and for legal/financial recordkeeping.

7. Data Retention

We retain personal information for as long as the user has an account with us and as needed to provide services. Transaction records and minimal accounting data may be retained longer where required by law.

8. User Rights & Controls

You have the right to access, correct, or delete your personal data where required by applicable law. To request deletion of your account and associated data, please follow the instructions at:

Delete account / data request: https://benevestx.github.io/delete-account

Or email us at: {{help.benevest@gmail.com}} (replace with your real support email). Requests will be processed in accordance with applicable law; we will ask for identity verification to prevent fraudulent requests.

9. Partial Deletion & Portability

At present users may request full account deletion. We do not currently provide an in-app tool to selectively delete specific data categories without deleting the account. If you would like to request selective data removal, contact us via the email above.

10. Security

We use industry-standard technical and organizational measures to protect personal information in transit and at rest (HTTPS/TLS, access controls, password hashing). However, no system is 100% secure; we cannot guarantee absolute security.

11. Children

Our App is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe we have collected data from a child in error, contact us and we will delete it.

12. International Transfers

We may transfer personal information to service providers located in other countries. Where required by law, we will ensure appropriate safeguards (e.g., DPAs, standard contractual clauses) are in place.

13. Changes to This Policy

We may update this Privacy Policy. If we make material changes, we will post the updated policy with a new effective date. Continued use of the App after changes constitutes acceptance of the updated policy.

14. Contact Information

Last updated: September 10, 2025